diff options
Diffstat (limited to 'doc/source/features.rst')
| -rw-r--r-- | doc/source/features.rst | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/doc/source/features.rst b/doc/source/features.rst index e3ae876..407b9c7 100644 --- a/doc/source/features.rst +++ b/doc/source/features.rst | |||
| @@ -309,7 +309,7 @@ be raised if the types aren't matching. | |||
| 309 | are optional, but you don't have to use them in your code to benefit from them, | 309 | are optional, but you don't have to use them in your code to benefit from them, |
| 310 | since every internal function from php has them. | 310 | since every internal function from php has them. |
| 311 | 311 | ||
| 312 | This option provide a switch to globally activate this strict mode, | 312 | This option provides a switch to globally activate this strict mode, |
| 313 | helping to uncover vulnerabilities like the classical | 313 | helping to uncover vulnerabilities like the classical |
| 314 | `strcmp bypass <https://danuxx.blogspot.fr/2013/03/unauthorized-access-bypassing-php-strcmp.html>`_ | 314 | `strcmp bypass <https://danuxx.blogspot.fr/2013/03/unauthorized-access-bypassing-php-strcmp.html>`_ |
| 315 | and various other types mismatch. | 315 | and various other types mismatch. |
| @@ -384,10 +384,10 @@ besides templating and building mathematical expressions based on user input, | |||
| 384 | it's broadly (mis)used all around the web. | 384 | it's broadly (mis)used all around the web. |
| 385 | 385 | ||
| 386 | Snuffleupagus provides a white and blacklist mechanism, to explicitly allow | 386 | Snuffleupagus provides a white and blacklist mechanism, to explicitly allow |
| 387 | and forbid specific functions call from being issued inside ``eval``. | 387 | and forbid specific function calls from being issued inside ``eval``. |
| 388 | 388 | ||
| 389 | While it's heavily recommended to only use the whitelist feature, the blacklist | 389 | While it's heavily recommended to only use the whitelist feature, the blacklist |
| 390 | one exists because some adminsys might want to use it to catch automated | 390 | one exists because some sysadmins might want to use it to catch automated |
| 391 | script-kiddies attacks, while being confident that doing so won't break a | 391 | script-kiddies attacks, while being confident that doing so won't break a |
| 392 | single website. | 392 | single website. |
| 393 | 393 | ||
